NVD

Id
48946  
Name
CVE-2009-1677  
Description
Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account"s "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-05-18  
Modified Date
2009-06-09  
Seq
2009-1677  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
247284 48946 CVE-2009-1677 8659  View
247285 48946 CVE-2009-1677 20090512 Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit  View
247286 48946 CVE-2009-1677 34910  View
247287 48946 CVE-2009-1677 bitweaver-savefeed-code-execution(50631)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42421 JVNDB-2009-003428 Bitweaver の saveFeed 関数における任意の PHP コードをファイルに挿入される脆弱性 Bitweaver の rss/feedcreator.class.php の saveFeed 関数には、静的コードを不正に埋め込まれる不備があるため、任意の PHP コードをファイルに挿入される脆弱性が存在します。 CVE-2009-1677 39108 CVE-2009-1677 48946 6.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003428.html 2009-05-18 2012-06-26 View